CVE-2016-5873

Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
VendorProductVersion
phppecl_http
𝑥
≤ 3.0.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php-pecl-http
bullseye
4.0.0+3.2.4+2.6.0-0+deb11u1
fixed
jessie
not-affected
bookworm
4.2.3-3.1
fixed
sid
4.2.4-1
fixed
trixie
4.2.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php-pecl-http
cosmic
not-affected
bionic
not-affected
artful
ignored
zesty
ignored
yakkety
ignored
xenial
not-affected
wily
ignored
trusty
dne
precise
dne
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2016/06/29/1
http://www.openwall.com/lists/oss-security/2016/06/29/4
http://www.securityfocus.com/bid/95863
https://bugs.php.net/bug.php?id=71719
https://github.com/m6w6/ext-http/commit/3724cd76a28be1d6049b5537232e97ac
https://pecl.php.net/package/pecl_http/3.0.1
https://security.gentoo.org/glsa/201612-17
https://security.netapp.com/advisory/ntap-20180112-0001/
http://www.openwall.com/lists/oss-security/2016/06/29/1
http://www.openwall.com/lists/oss-security/2016/06/29/4
http://www.securityfocus.com/bid/95863
https://bugs.php.net/bug.php?id=71719
https://github.com/m6w6/ext-http/commit/3724cd76a28be1d6049b5537232e97ac
https://pecl.php.net/package/pecl_http/3.0.1
https://security.gentoo.org/glsa/201612-17
https://security.netapp.com/advisory/ntap-20180112-0001/